Everyone's talking about shadow AI. Almost no one has actually measured it.
Ask a room of MSPs whether shadow AI is a risk and every hand goes up. Ask how exposed any one client actually is, and the room goes quiet.
Awareness is everywhere. Few teams have actually measured it, and that gap is where the real exposure lives.
Awareness is everywhere. Few have measured it.
Most leaders would guess a small slice of staff touch AI tools. The real number is closer to half, and many of them are pasting customer lists, source code, and contract language into sites nobody approved.
The same browser tab that makes an employee fast is where the most sensitive work now slips out, one prompt at a time. It rarely looks like an attack. It looks like someone being helpful with a tool they like, which is exactly why it spreads quietly and why a yearly policy reminder never catches it.
Blocking it just moves the problem
The first instinct is to ban the tools. Blocking pushes the same behavior onto personal devices and personal accounts, where there is even less to see and nothing to govern.
The teams getting this right work in a different order. They measure first, then govern at the place the data actually moves. For AI tools, that place is the browser, the one point that sees the prompt, the paste, and the credential before any of them leave the building.
Put a number on it
Before the next client conversation, turn the hot topic into something concrete: a score you can show, and a short list of what to fix first. Seven questions, about sixty seconds, no sign-up.
Shadow AI Exposure Scorecard
How exposed are your clients, really?
Where to start once you know
Wherever a client lands on that scale, the fix follows the same order.
See which AI tools are actually in use across every tenant, so risk stops being invisible. Control where credentials and data can go, right inside the browser session, so a sanctioned tool stays usable while an unsanctioned paste meets a policy. And keep a record of AI prompts, so the question every auditor and insurer now asks, "did anything leak through an AI tool?", has an answer in minutes rather than a shrug.
None of this requires new hardware or a change in how people work. It runs as a lightweight agent and a browser extension, across managed and unmanaged devices alike, from one multi-tenant console.
Shadow AI is the conversation. The browser is where you win it.
For an MSP, that is the rare combination: a risk clients already feel, closed by a service you can roll out across every tenant in minutes and bill every month. Stronger protection for the client, a new recurring line for you, and a gap quietly closed that most providers have not even named yet.
The tools your clients adopted are not going away. The MSPs who can measure the exposure, and govern it where it happens, will be the ones their clients keep.
